CVE-2026-71195

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the attacker's project; soft_delete: move a foreign share to the recycle bin; restore: interfere with the owner's deletion workflow; export location metadata: create, update, and delete metadata on foreign export locations; access rule listing: disclose IPs, usernames, and CephFS keys. Any authenticated project member can exploit these operations on any public share. The share UUID is visible since the share is public.

• CWE-863

• https://launchpad.net/bugs/2161412
• https://openwall.com/lists/oss-security/2026/10/20/18
• https://security.openstack.org/ossa/OSSA-2026-046.html
• https://www.openwall.com/lists/oss-security/2026/10/20/18
• https://bugs.launchpad.net/ossa/+bug/2161412

Published

Oct 21, 2026

Last Modified

Oct 27, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7119A vulnerability was detected in Tenda HG3 2.0. The impacted …8.8
• CVE-2026-71190In OpenStack Swift through 2.38.0, the proxy server Accept h…8.7
• CVE-2026-71191In OpenStack Swift through 2.38.0, S3API middleware does not…6
• CVE-2026-71192In OpenStack Swift through 2.38.0, the S3API middleware does…6
• CVE-2026-71193In OpenStack Designate before 22.0.1, zone creation checks (…9.6
• CVE-2026-71194In OpenStack Designate before 22.0.2, the mDNS handler perfo…6.8
• CVE-2026-71198In OpenStack Glance before 32.0.1, the location API does not…7
• CVE-2026-7120@fastify/static evaluates the allowedPath callback before no…5.3
• CVE-2026-71201In OpenStack Ironic through 38.0.0, a project reader that ma…5
• CVE-2026-71202The raster Rust crate's crop function (src/editor.rs) clamps…7.5
• CVE-2026-71203changedetection.io's REST API resources are protected by an …5.3
• CVE-2026-71204changedetection.io's /settings save handler builds an update…6.2